nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-08-29 18:26:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add rudimentary munging of usernames etc. for better security.

Browse Source
This commit is contained in:
Andrew McMillan 2008-11-10 11:50:24 +13:00
parent d360f220f5
commit 6ac9985fba
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
inc/drivers_squid_pam.php
View File

@ -53,6 +53,12 @@ class squidPamDrivers
function SQUID_PAM_check($username, $password ){
global $c;
/**
* @todo Think of the children! This is a horribly insecure use of unvalidated user input! Probably it should be done with a popen or something, and it seems remarkably dodgy to expect that naively quoted strings will work in any way reliably.
* Meanwhile, I've quickly hacked something basic in place to improve the situation. No quotes/backslashes in passwords for YOU!
*/
$username = str_replace("'","",str_replace('"',"",str_replace('\\',"",$username)));
$password = str_replace("'","",str_replace('"',"",str_replace('\\',"",$password)));
$cmd = "echo '" . $username . "' '" . $password . "' | " . $c->authenticate_hook['config']['script'] . " -n common-auth";
$auth_result = exec($cmd);
if ( $auth_result == "OK") {